Notice of Data Breach
On Sept. 16, 2021, the Alaska Department of Health and Social Services (DHSS) notified Alaskans via a press release and a notice on our website, dhss.alaska.gov, that a security breach of the Health Insurance Portability and Accountability Act (HIPAA) and the Alaska Personal Information Protection Act (APIPA) had occurred due to a highly sophisticated cyberattack. This cyberattack to the DHSS website was first detected in May 2021.
Cyberattack History
On May 5, 2021, the State of Alaska Security Office notified DHSS, through proactive surveillance, of a cyberattack that involved unauthorized access to a DHSS computer system. Following the attack, DHSS engaged cybersecurity expert FireEye Mandiant (Mandiant) to help analyze the attack, contain it, remove the attacker from our website, and provide guidance to harden and recover our systems.
What Information Was Involved
As part of its response, DHSS shut down systems supporting numerous services to protect individuals’ information and to deny the attacker further access. Before DHSS implemented the shutdown, the attackers potentially had access to the following types of individuals’ information:
- Full names
- Dates of birth
- Social Security numbers
- Addresses
- Telephone numbers
- Driver’s license numbers
- Internal identifying numbers (case reports, protected service reports, Medicaid, etc.)
- Health information
- Financial information
- Historical information concerning individuals’ interaction with DHSS
What We Are Doing
DHSS remains focused on the best interests of Alaskans. You trust us with your important health information, and we take that responsibility very seriously. DHSS is continuing to implement measures to protect Alaskans’ information, including:
- Further strengthening of our systems to deter future incidents
- Continuing to work with law enforcement
- Offering cybersecurity protection services to our customers, such as identity theft and fraud protection insurance
In addition, we are offering identity theft protection services through IDX, the nation’s leading data breach and recovery services expert. IDX identity protection services include: 12 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services. With this protection, IDX will help you resolve issues if your identity is compromised.
What You Can Do
We encourage you to contact IDX with any questions and to enroll in the free identity protection services by calling (833) 513-2608 or going to
Alaska Department of Health and Social Services and using the Enrollment Code provided below. IDX representatives are available Monday through Friday from 5 am - 5 pm Alaska Time. Please note the deadline to enroll is December 28, 2021.
Enrollment Code: XXXXXXXXXX
Again, while at this time Mandiant has found no evidence that your information has been stolen. However, given the capabilities of the nation-state attacker and scope of access they had, we encourage you to take full advantage of this service offering. IDX representatives have been fully versed on the incident and can answer questions or concerns you may have regarding protection of your personal information.
For More Information
For more information about how to avoid identity theft, please visit the U.S. Federal Trade Commission’s website at: identitytheft.gov.
Please call (833) 513-2608 or go to
Alaska Department of Health and Social Services for assistance or for any additional questions you may have.
We sincerely apologize for this inconvenience. The Alaska Department of Health and Social Services is committed to providing service with excellence, which includes protecting your personal information.
Sincerely,
Adam Crum
Commissioner
Alaska Department of Health and Social Services
IDX, 10300 SW Greenburg Road Suite 570, Portland, OR, 97223 US
Privacy Policy